Posted
by
timothyon Tuesday December 15, 2009 @12:03PM
from the gnome's-reader's-pretty-good-y'know dept.

itwbennett writes "Monday afternoon, Adobe 'received reports of a vulnerability in Adobe Reader and Acrobat 9.2 and earlier versions being exploited in the wild,' the company said in a post to the company's Product Security Incident Response Team blog. According to malware tracking group Shadowserver, the vulnerability is due to a bug in the way Reader processes JavaScript code. Several 'tests have confirmed this is a 0-day vulnerability affecting several versions of Adobe Acrobat [Reader] to include the most recent versions of 8.x and 9.x. We have not tested on 7.x, but it may also be vulnerable,' Shadowserver said in a post on its Web site. The group recommends that concerned users disable JavaScript within Adobe's software as a work-around for this problem. (This can be done by un-checking the 'Enable Acrobat JavaScript' in the Edit -> Preferences -> JavaScript window). 'This is legit and is very bad,' Shadowserver added."

I agree. These security vulnerabilities appear to be a weekly occurrence. Anyone that hasn't disabled Javascript in Reader/Acrobat at this point either doesn't care about the numerous vulnerabilities or doesn't understand the risks involved.

The bigger question is why Adobe doesn't just disable Javascript by default. I have never used a PDF that required Javascript and I've dealt with a number of user-fillable forms. So, what exactly is Javascript being used for? I know that it has some use. However, it seems that the security risk is far greater than any potential benefit of the "feature".

So, what exactly is Javascript being used for? I know that it has some use. However, it seems that the security risk is far greater than any potential benefit of the "feature".

DRM, I've heard. Another reason for having it would likely be that Adobe needs to be ahead of the competition, for example by supporting multimedia content. There are, after all, a lot of very good pdf readers/writers (and editors?) out there.

JavaScript in PDFs has always been trouble. I use forms that auto complete, add columns, etc. A compromise might be a default of prompt before running scripts with a recommend/default of "no". I'd always click "no" unless I trusted the source. Since that would marginalize the product it will probably never happen. I wish I had never upgraded from 4.

It's easy enough to disable, but everytime a doc gets loaded with embedded JS, the reader will prompt to enable it with a message saying something like "the document may not display correctly" without it enabled. Clicking the "yes" will then re-enable it. The problem with this approach is that we get so many warnings that people may automatically start enabling JS accidentally.

Based on the numerous JS vulnerabilities, the default should be "No". A message should warn about the security vulnerabilities of running the document and tell the user only to enable JS (temporarily) if they trust the source of the document. However, it should also mention that if JS is disabled, it may not display correctly.

The fact is that Adobe simply doesn't care about the vulnerabilities. They have responded slowly or not at all to the issue.

...or has been repeatedly told by their bosses that it's a "never going to happen" risk and that "antivirus and perimeter security will stop all malware".

Yeah, I don't work there any more, but there are plenty of people who are all too aware of the twatworthy shitness of acrobat that have absolutely no means of a) switching to an alternative (I love SumatraPDF for windows) or b) turning off the more idiotic default settings "in case it breaks something". Ah, status quo is god... how can you be a "pro-active

The bigger question is why Adobe doesn't just disable Javascript by default.

Because the intent is to push you towards using their software for as many things as they can get you to. The more things you use it for, the more reliant you are on it, the more likely you are to buy more copies.

I don't think it's all that nefarious in intent. They want their software to be useful and cutting-edge. If their intent was only to create a fast PDF reader/writer, then they'd be done sometime around Acrobat 4. Every version since would be bug-fixes, performance improvements, and updates in

Somewhat ironic, isn't it? If you want to use Adobe's security features (digital signing/encryption) and 3rd party software to achieve SOX compliance - you must accept security vulnerabilities from Acrobat/Reader itself.

What bothers me about this is that once its disabled it just prompts you to enable it once it senses a JS PDF. The end user, if he or she has rights (and they do at home), just clicks another OK box instead of being forced to go into preferences and turn it back on. Once thats clicked it runs the JS and the exploit. Its ridiculous its even on by default, let alone this UI stupidity.

The next version of Acrobat should just have it off by default. Force people to turn it on. Chances are 99.9% of users have n

I have javascript disabled at each user login on our network (through the logon script), just in case someone has re-enabled it when their system was last logged on. I haven't found a way to totally lock it out yet.

The huge problem is that Adobe offers to enable javascript for users when they open a PDF with Javasript in it. It displays a message along the lines of "you're not seeing everything here unless you enable javascript...click here to enable it" with a big friendly "YES" button. Kind of defeats

Why is Reader being used in large-scale deployments? It's freeware-ish and gets no more support from Adobe than many of the other free pdf reader alternatives out there would get. I have Reader installed at my work without having Writer or Photoshop either.

I would love a good alternative personally. All my users do is read the PDFs and we use PDFCreator for merging documents. I just havent found one that seems to be solid enough for the enterprise push. Any recommendations from people who have made the switch? I am getting tired of patching every 5 minutes.

On Windows? Foxit Reader or PDF Xchange viewer ( http://www.docu-track.com/ [docu-track.com] ). Unlike Acrobat Reader, both have tabbed interfaces, can remember which docs were open and reopen them automatically.

I think PDF Xchange also will track where you were in each opened document and will take you rightback to the page you were reading when reopened.

This can be done by un-checking the 'Enable Acrobat JavaScript' in the Edit -> Preferences -> JavaScript window.

I've used Reader forever, and I never even noticed that there was a preferences dialog. There's 26 sub-dialogs, each with one or two dozen options, and (checking a few at random) I see several that look worthy of more investigation. Anyone know of any recommendations of where I should start?

In W7 I had a problem where installing Foxit while Adobe were present would cause W7 to regularly forget the existence of the pdf extension, forcing the user to choose the program to use when trying to open a pdf. The fix were to uninstall Adobe and reinstall Foxit.

They're horrible. You have guys flipping and attacking you with their feet while standing on their hands. You have two other guys with one sitting on the other's shoulders while they punch down on you. You try to fight back and they just do backflips away or jump and balance on some pole way above your head.

Seriously, The launch time for a PDF off the web is too large for me to bother. First it's gotta download that 7 Meg file, then Adobe's gotta kick start, and then it doesn't let me highlight anything to keep me from copying and pasting.

Seriously - I have only ever seen PDF's used at work and at school, and anywhere else they exist usually aren't worth the bother.

I second Okular, it does this wicked thing where while dragging a document to scroll, the mouse cursor wraps from the top of the screen to the bottom (or vice-versa). It seems odd when you hear about it, but once you use it you'll swear by it.

Half of my readings in Law School are scanned documents/books in PDF format. Many of the documents are 25-40 MB in size and several hundred pages. I find that PDFs actually load very quickly - much faster than a similarly sized Word or Open Office document, and easier to read. Of course, you can use any PDF reader and not just Adobe Reader/Acrobat.

On my Core 2 Duo and Core i7 systems, I can open PDFs pretty much instantaneously (less than 0.5 seconds). The only delay is the download. Thankfully, this is one

It is high time people stop using any pdf reader that uses javascript or opens external links or does anything other than simply render the document on screen. Editable pdf, where one can fill in the fields etc must be a separate application, not plugged into the browser. I feel safe with NoScript controlling FireFox. Hope someone comes up with a good general purpose sandboxer that will sandbox every plug-in.

The companies which require this functionality have already decided to use the market leader's product. Since you have absolutely no way of convincing them all to switch to something else, perhaps you should be the one to look for alternative solutions.

You had a niche application, WYSISWYPrint. Try to compete with the swift, quick to load, quick to render competition or you will be lost in the netherworld between browsers and pdf renderers.

If anything, the PDF standard is increasing usage worldwide. PDF is a very well documented standard -- I speak as someone who wrote a program to create PDF files with images and form fields from scratch using VB 6 with no plugins -- so go ahead and create your own reader, market it and make it the #1. Nothing's stopping you.

Seems like deja vu, since this has issue cropped up before [sans.org], what with everything from Adobe wanting to install (at least on Mac and Windows) with system level privileges and enable javascript by default. [Tell me again, how is javascript a desirable feature for this file type?]

Which makes it a good idea to use alternatives like Preview, and Skim [sourceforge.net] (for OS X), as well as Foxit Reader [foxitsoftware.com] for Windows.

It's not like there's a paucity of options to get away from Adobe's bloatware, no matter what OS you're running.

I was browsing a soft porn site and suddenlty Acrobat launched, then crashed. So it looks like someone really is trying to use this. Since I use Acrobat 4, I think I'm safe from this. (I need a full version of Acrobat for DTP, and version 4 does the job, and quite quickly. If I need to open a later version file I use FoxIt.)

I did turn off scripting for that site, of course. And I already block most ads (porn site ads can be rather icky, and possibly hostile). I couldn't see what was launching the PDF, may have been in an ad, or the site code itself. But as I said, it just launched and crashed, so no panic.

Seriously. Web pages are interactive. Documents are meant to be read and maybe filled out. The only reason we need PDF is for stuff that needs to look the same on every screen and print out the way it looks. We don't need Javascript in them.

I'm not sure if text redaction is a feature, they just drew a bunch of black rectangles over the text and them someone pointed out that that doesn't actually make the text go away, it's just under the rectangle.

Screw Acrobat, Adobe needs to fix Flash. Flash CS4 is the worst software I've ever used (I've been using Flash since Flash 5, now we're on Flash 10 and they still haven't fixed the major bugs).

The "redaction" was because someone used a text object to overlay the source. They could have avoided failure by using the built-in redaction feature, modifying the pages at the source and generating the PDF from that, or scanning the original (with redacted sections blacked out) as graphics.

For some reason the idiots at the TSA thought that an opaque black highlighter would be adequate to obliterate the text. Morons.

(Before you say “well, duh, anybody would” – no. You wouldn’t trust this on printed documents, either. You’d photocopy them, ensuring that the photocopier’s sensor couldn’t distinguish between the text and the marker it was covered with. The original document c

After being bitten by a PDF vulnerability before (I run as a normal user account so it didn't completely own my box and was fairly easy to clean up) I disabled the PDF plugin in Firefox. Now if I try to view a PDF I get an open/download request for the file rather than just opening automatically.

This way a site can't open any PDF files without me knowing.

It seems Adobe PDF reader is fast becoming the new IE in terms of web security.

This has nothing to do with "web security" -- IE's problems are because it allows access for remote sites to local resources. It also has a lot of holes.

MIME types -- the things that enable launching Acrobat when a PDF file is encountered -- are used to determine how to display images, sounds etc. Surely you're not advocating disabling all MIME types, or confirming each one? You could have a plain text page with no images, sounds, etc and you'd never be surprised by things launching or displaying without

Opening PDFs in the browser is just an extra convenience anyway. When I click a link to a PDF, it automatically downloads to the desktop and I can open it from there, if I actually wanted to download and open the PDF. I don’t need it to load inside my browser (and if I didn’t expect it, I probably won’t appreciate having to wait for the plugin to load).

Since they already program the Reader software, then why even use JavaScript to handle interactive form input? Program their own handler.

On the other hand, why write your own handler for interactive forms input when the OS can provide that service to you (presumably with much greater security, much less coding errors, desktop theme consistency, and other benefits)?

No, PDF format is a crippled postscript. It was intentionally crippled so it will NOT be a language, because distributing documents written in a programming language was not secure. Then they realized they crippled it too much, and added javascript to it. It is an improvement, since the scripts are localized in the document, easier to identify, they can be disabled if you want to, etc.

I think in general having scripting language embedded into an interactive document format is a good idea, however, it seems that Adobe's implementation is rather buggy and badly designed.

To send an email after filling out a form and clicking sumbit in a PDF.

Honestly - It's not really like the Adobe reader has the vulnerability, its just javascript in general. I mean it's not great that the reader will execute the code just by opening the file - but now that you know it does that, is it really the readers fault? Isn't the user executing the code as if he were clicking a button now?

It's more useful than you might think. I've personally used it for two purposes:

For a food diary, I put in my current weight and it calculated my daily caloric needs and calories burned for different intensities of exercise.

For roleplaying game character sheets, there are a ton of fields that are dependent on other fields. Javascript lets you enter your dexterity score, for example, and your dexterity mod, defenses, and dex-based skills are all updated accordingly.

For roleplaying game character sheets, there are a ton of fields that are dependent on other fields. Javascript lets you enter your dexterity score, for example, and your dexterity mod, defenses, and dex-based skills are all updated accordingly.

For roleplaying game character sheets, there are a ton of fields that are dependent on other fields. Javascript lets you enter your dexterity score, for example, and your dexterity mod, defenses, and dex-based skills are all updated accordingly.

I’m just echoing what the other guy said, really, but I created a helluva Excel spreadsheet that did that for Runescape. Why on earth would you use a PDF?

Heck... I could probably even make it import the player data from the hiscores website, but I didn’t ever bother trying.

Having no experience with a PDF, you’re going to have to describe that for me. Referencing cells is pretty easy in Excel, and you can lock all the non-user-editable cells so that they can only move the cursor into the ones they can edit.

Imagine a sheet that looks like the one from the back of the book, but you can type in it and all the numbers fill in automatically. It's not that I think spreadsheets are unnavigable, it's just that using a pdf is a much more pleasant experience to the eye. When I look at something for hours on end, I want it to look nice. I also like to be able to give it to a player and they are familiar with the layout.

Using a PDF means you don't have to worry about spreadsheet versions. A spreadsheet app is also substantially larger than a PDF reader. Not everyone even has spreadsheet software installed on their computer.

This *is* Adobe we're talking about here. For grins, I just installed Adobe Reader 9.2 and Gnumeric 1.9.16 on a XP VM, and for the informal survey of the "Program Files" directory, Adobe (203MB) weighs in at almost twice that of Gnumeric (106MB).

I vote for using the best app for the job. In the case of this thread, I wholeheartedly think the spreadsheet is that tool.

Adobe Acrobat 5.x was still kind of bloated. Even on machines nowadays it'll still take a few seconds to boot up - with that annoying little splash screen of some guy prancing about with a few office complexes in the background.

I've never used just the 5.x reader before, where would you even GET that...

A few seconds? On a modern machine I can load a 100 page scanned PDF in Adobe Acrobat in under 0.5 seconds (perceptibly instant with Aero) with Acrobat 9.0.2 on a Core 2 Duo/Core i7. Are you using a slow machine?

This may be a difference between Windows 7 and Windows XP. Superfetch in Windows 7 loads the binary into RAM after first run - or if it's a commonly used program - automatically. Therefore, I'm almost always running the program from RAM.

However, even on the initial start, it doesn't take more than 1-2 seconds. I haven't used Acrobat 5.0 in such a long time. Perhaps Reader loads faster.

If you've ever worked with such off-shore developers, you'll immediately understand why Reader is such a shitty piece of software.

Yes because it's ok to buy something and not to bother making sure you're getting your money's worth.

Responsibility lies with management for not implementing some sort of quality control - ESPECIALLY when dealing with offshore outfits. It's called due diligence. But since a lot of managers only care about their paycheck and not the brand's reputation, etc., well, this crap happens. If the board are too busy figuring out how much to pay themselves on top of that, well, that's the corporate world in a nutshell.

Hold on, now, at some point, Adobe WAS a good product, until everybody found out ( did the hackers know way before??) that some javascript was not safe. Hell 3/4 of sites using js in their pages is unsafe, but don't do anything about it.

The reason why they need any js in there is beyond me, as I have never used any pdfs with js embedded....but I am sure there is a reason, they should just take it out completely out of all their versions, and add an add-on utility that adds it back in, that way only the trul

You're right that management has to share responsibility. Off-shoring exposes management incompetency. If you get Off-shore programmers that lack experience because they were shoved through some quick schooling to meet demand then they simply won't be able to do the job right even if he were a local.

The manager should stop the shoddy product from coming out but he won't because he was never good at his job. The difference is when they had to hirer locals at a decent wage they're more likely to be qualifi

I would love to see Symantec listed as malware... have you seen how difficult it is to actually uninstall that thing (completely), and what a piece of spamming shit it turns into once your free trial is over ?